ework-web 0.1.0

package/src/logger.ts

@@ -0,0 +1,44 @@
+type Level = "debug" | "info" | "warn" | "error"
+
+const LEVELS: Record<Level, number> = { debug: 10, info: 20, warn: 30, error: 40 }
+
+function threshold(): number {
+  const configured = (process.env.WORK_LOG_LEVEL || "info").toLowerCase()
+  return LEVELS[configured as Level] ?? LEVELS.info
+}
+
+function emit(level: Level, msg: string, fields?: Record<string, unknown>): void {
+  if (LEVELS[level] < threshold()) return
+  const payload: Record<string, unknown> = {
+    t: new Date().toISOString(),
+    level,
+    msg,
+  }
+  if (fields) {
+    for (const [k, v] of Object.entries(fields)) {
+      if (v instanceof Error) payload[k] = { name: v.name, message: v.message, stack: v.stack }
+      else if (v !== undefined) payload[k] = v
+    }
+  }
+  const line = JSON.stringify(payload)
+  if (level === "error" || level === "warn") process.stderr.write(line + "\n")
+  else process.stdout.write(line + "\n")
+}
+
+export const log = {
+  debug: (msg: string, fields?: Record<string, unknown>) => emit("debug", msg, fields),
+  info: (msg: string, fields?: Record<string, unknown>) => emit("info", msg, fields),
+  warn: (msg: string, fields?: Record<string, unknown>) => emit("warn", msg, fields),
+  error: (msg: string, fields?: Record<string, unknown>) => emit("error", msg, fields),
+}
+
+export const startTime = Date.now()
+
+export function uptimeSeconds(): number {
+  return Math.floor((Date.now() - startTime) / 1000)
+}
+
+const VERSION = "0.1.0"
+export function version(): string {
+  return VERSION
+}

package/src/opencode.ts

@@ -0,0 +1,340 @@
+import type { Config } from "./config";
+import { Database } from "bun:sqlite";
+import { openSync, closeSync, readFileSync, unlinkSync } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+
+// OpenCode session client — READ-ONLY. Transcript detail goes through the
+// `opencode export` CLI (stable, no schema coupling); the session LIST reads the
+// DB directly (read-only bun:sqlite) because `opencode session list` filters out
+// recent sessions by project/version — a global SELECT is the only way to list all.
+// Editing (step 2) is deferred to an isolated Docker opencode.
+// NOTE: `opencode export` truncates at 64KB when stdout is a pipe, so we redirect
+// it to a temp file (same workaround oclog uses).
+
+export class OpencodeError extends Error {
+  status: number;
+  constructor(message: string, status: number) {
+    super(message);
+    this.name = "OpencodeError";
+    this.status = status;
+  }
+}
+
+export interface SessionListItem {
+  id: string;
+  title: string;
+  created: number;
+  updated: number;
+  directory?: string;
+  peakTokens?: number;
+  msgCount?: number;
+}
+
+export interface SessionInfo {
+  id: string;
+  title: string;
+  directory: string;
+  version: string;
+  time: { created?: number; updated?: number };
+}
+
+export interface ToolState {
+  input?: unknown;
+  output?: unknown;
+  status?: string;
+  title?: string;
+}
+
+export interface MessagePart {
+  type: string;
+  text?: string;
+  tool?: string;
+  state?: ToolState;
+}
+
+export interface MessageTokens {
+  total?: number;
+  input?: number;
+  output?: number;
+  reasoning?: number;
+  cache?: { read?: number; write?: number };
+}
+
+export interface MessageInfo {
+  role: string;
+  id: string;
+  agent?: string;
+  modelID?: string;
+  time?: { created?: number };
+  tokens?: MessageTokens;
+}
+
+export interface SessionMessage {
+  info: MessageInfo;
+  parts: MessagePart[];
+}
+
+export interface SessionExport {
+  info: SessionInfo;
+  messages: SessionMessage[];
+}
+
+export class OpencodeClient {
+  private readonly bin: string;
+  private readonly dbPath: string;
+  private readonly timeoutMs: number;
+  private readonly maxBytes = 50 * 1024 * 1024;
+
+  constructor(cfg: Config) {
+    this.bin = cfg.opencodeBin;
+    this.dbPath = cfg.opencodeDbPath;
+    this.timeoutMs = cfg.upstreamTimeoutMs;
+  }
+
+  // Global session list via read-only SQLite SELECT. `opencode session list` (CLI)
+  // filters out recent sessions by project/version, so only a direct DB read lists
+  // all. WAL mode: a read-only connection never blocks opencode's writes.
+  async listSessions(limit: number): Promise<SessionListItem[]> {
+    let db: Database;
+    try {
+      db = new Database(this.dbPath, { readonly: true });
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      throw new OpencodeError(`cannot open opencode DB (${this.dbPath}): ${msg}`, 502);
+    }
+    try {
+      const rows = db
+        .prepare(
+          "SELECT s.id AS id, s.title AS title, s.time_created AS created, s.time_updated AS updated, s.directory AS directory, " +
+            "m.peak AS peakTokens, m.calls AS msgCount " +
+            "FROM session s LEFT JOIN (" +
+            "SELECT session_id, MAX(CAST(json_extract(data,'$.tokens.input') AS INT) + CAST(json_extract(data,'$.tokens.cache.read') AS INT) + CAST(json_extract(data,'$.tokens.cache.write') AS INT)) AS peak, " +
+            "COUNT(*) AS calls FROM message WHERE json_extract(data,'$.tokens.input') > 0 GROUP BY session_id" +
+            ") m ON m.session_id = s.id " +
+            "WHERE s.time_archived IS NULL ORDER BY s.time_updated DESC LIMIT ?"
+        )
+        .all(limit) as Array<{ id: unknown; title: unknown; created: unknown; updated: unknown; directory: unknown; peakTokens: unknown; msgCount: unknown }>;
+      return rows
+        .map((r) => {
+          const id = typeof r.id === "string" ? r.id : "";
+          if (!id) return null;
+          return {
+            id,
+            title: typeof r.title === "string" && r.title ? r.title : "(untitled)",
+            created: typeof r.created === "number" ? r.created : 0,
+            updated: typeof r.updated === "number" ? r.updated : 0,
+            directory: typeof r.directory === "string" ? r.directory : undefined,
+            peakTokens: typeof r.peakTokens === "number" && r.peakTokens > 0 ? r.peakTokens : undefined,
+            msgCount: typeof r.msgCount === "number" && r.msgCount > 0 ? r.msgCount : undefined,
+          } as SessionListItem;
+        })
+        .filter((x): x is SessionListItem => x !== null);
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      throw new OpencodeError(`session list query failed: ${msg}`, 502);
+    } finally {
+      db.close();
+    }
+    }
+
+  async exportSession(id: string): Promise<SessionExport> {
+    if (!/^[A-Za-z0-9_-]+$/.test(id)) {
+      throw new OpencodeError(`bad session id: ${id}`, 400);
+    }
+    const raw = await this.runJSON(["export", id]);
+    const exp = parseSessionExport(raw);
+    if (!exp) throw new OpencodeError(`malformed export for ${id}`, 502);
+    return exp;
+  }
+
+  async exportSessionRaw(id: string): Promise<string> {
+    if (!/^[A-Za-z0-9_-]+$/.test(id)) {
+      throw new OpencodeError(`bad session id: ${id}`, 400);
+    }
+    const { stdout, code } = await this.run(["export", id]);
+    if (code !== 0) {
+      throw new OpencodeError(`opencode export ${id} → exit ${code}`, 502);
+    }
+    return stdout;
+  }
+
+  // --- subprocess plumbing ---
+
+  private async runJSON(args: string[]): Promise<unknown> {
+    const { stdout, code, stderr } = await this.run(args);
+    if (code !== 0) {
+      const why = stderr.trim() || `exit ${code}`;
+      const status = /not found|no such/i.test(why) ? 404 : 502;
+      throw new OpencodeError(`opencode ${args.join(" ")} failed: ${why}`, status);
+    }
+    const text = stdout.trim();
+    if (!text) return null;
+    try {
+      return JSON.parse(text);
+    } catch {
+      throw new OpencodeError(`opencode ${args.join(" ")}: non-JSON output`, 502);
+    }
+  }
+
+  private async run(args: string[]): Promise<{ stdout: string; stderr: string; code: number | null }> {
+    // stdout → temp file: `opencode export` truncates at 64KB when stdout is a
+    // pipe (kernel pipe buffer). stderr is small (progress lines) so a pipe is fine.
+    const tmp = join(tmpdir(), `ocweb-${process.pid}-${Math.random().toString(36).slice(2)}.json`);
+    const fd = openSync(tmp, "w");
+    const proc = Bun.spawn([this.bin, ...args], {
+      stdout: fd,
+      stderr: "pipe",
+      env: process.env,
+    });
+    // Kill the process if it runs too long, so a hung CLI can't stall a request.
+    const killer = setTimeout(() => {
+      try { proc.kill(); } catch { /* already exited */ }
+    }, this.timeoutMs);
+    let stderr = "";
+    let code: number | null = null;
+    try {
+      stderr = await readCapped(proc.stderr, 64 * 1024);
+      code = await proc.exited;
+    } finally {
+      clearTimeout(killer);
+      try { closeSync(fd); } catch { /* already closed */ }
+    }
+    let stdout = "";
+    if (code === 0) {
+      try {
+        stdout = readFileSync(tmp, "utf-8");
+      } catch { /* file vanished — treat as empty */ }
+      if (stdout.length > this.maxBytes) {
+        try { unlinkSync(tmp); } catch { /* best-effort */ }
+        throw new OpencodeError(`opencode output exceeded ${this.maxBytes} bytes`, 413);
+      }
+    }
+    try { unlinkSync(tmp); } catch { /* best-effort */ }
+    return { stdout, stderr, code };
+  }
+}
+
+async function readCapped(stream: ReadableStream<Uint8Array> | null, maxBytes: number): Promise<string> {
+  if (!stream) return "";
+  const reader = stream.getReader();
+  const chunks: Uint8Array[] = [];
+  let total = 0;
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    if (value) {
+      total += value.byteLength;
+      if (total > maxBytes) {
+        try { await reader.cancel(); } catch { /* ignore */ }
+        throw new OpencodeError(`opencode output exceeded ${maxBytes} bytes`, 413);
+      }
+      chunks.push(value);
+    }
+  }
+  return Buffer.concat(chunks).toString("utf-8");
+}
+
+function asString(v: unknown): string {
+  return typeof v === "string" ? v : "";
+}
+
+function parseSessionExport(v: unknown): SessionExport | null {
+  if (!v || typeof v !== "object") return null;
+  const o = v as Record<string, unknown>;
+  const infoRaw = o.info;
+  const msgsRaw = o.messages;
+  if (!infoRaw || typeof infoRaw !== "object") return null;
+  const info = parseSessionInfo(infoRaw);
+  if (!info) return null;
+  const messages = Array.isArray(msgsRaw) ? msgsRaw.map(parseMessage).filter((x): x is SessionMessage => x !== null) : [];
+  return { info, messages };
+}
+
+function parseSessionInfo(v: unknown): SessionInfo | null {
+  if (!v || typeof v !== "object") return null;
+  const o = v as Record<string, unknown>;
+  const id = typeof o.id === "string" ? o.id : "";
+  if (!id) return null;
+  const timeRaw = o.time && typeof o.time === "object" ? (o.time as Record<string, unknown>) : {};
+  return {
+    id,
+    title: asString(o.title) || "(untitled)",
+    directory: asString(o.directory),
+    version: asString(o.version),
+    time: {
+      created: typeof timeRaw.created === "number" ? timeRaw.created : undefined,
+      updated: typeof timeRaw.updated === "number" ? timeRaw.updated : undefined,
+    },
+  };
+}
+
+function parseMessage(v: unknown): SessionMessage | null {
+  if (!v || typeof v !== "object") return null;
+  const o = v as Record<string, unknown>;
+  const infoRaw = o.info && typeof o.info === "object" ? o.info : null;
+  if (!infoRaw) return null;
+  const info = parseMessageInfo(infoRaw);
+  if (!info) return null;
+  const partsRaw = Array.isArray(o.parts) ? o.parts : [];
+  const parts = partsRaw.map(parsePart).filter((x): x is MessagePart => x !== null);
+  return { info, parts };
+}
+
+function parseMessageInfo(v: unknown): MessageInfo | null {
+  if (!v || typeof v !== "object") return null;
+  const o = v as Record<string, unknown>;
+  const id = typeof o.id === "string" ? o.id : "";
+  const role = typeof o.role === "string" ? o.role : "";
+  if (!id || !role) return null;
+  const modelRaw = o.model && typeof o.model === "object" ? (o.model as Record<string, unknown>) : null;
+  const timeRaw = o.time && typeof o.time === "object" ? (o.time as Record<string, unknown>) : null;
+  return {
+    role,
+    id,
+    agent: typeof o.agent === "string" ? o.agent : undefined,
+    modelID: modelRaw && typeof modelRaw.modelID === "string" ? modelRaw.modelID : undefined,
+    time: timeRaw && typeof timeRaw.created === "number" ? { created: timeRaw.created } : undefined,
+    tokens: parseTokens(o.tokens),
+  };
+}
+
+function parseTokens(v: unknown): MessageTokens | undefined {
+  if (!v || typeof v !== "object") return undefined;
+  const o = v as Record<string, unknown>;
+  const num = (k: string): number | undefined =>
+    typeof o[k] === "number" && Number.isFinite(o[k] as number) ? (o[k] as number) : undefined;
+  const t: MessageTokens = {};
+  if (num("total") !== undefined) t.total = num("total");
+  if (num("input") !== undefined) t.input = num("input");
+  if (num("output") !== undefined) t.output = num("output");
+  if (num("reasoning") !== undefined) t.reasoning = num("reasoning");
+  const c = o.cache;
+  if (c && typeof c === "object") {
+    const co = c as Record<string, unknown>;
+    const cr = typeof co.read === "number" && Number.isFinite(co.read as number) ? (co.read as number) : undefined;
+    const cw = typeof co.write === "number" && Number.isFinite(co.write as number) ? (co.write as number) : undefined;
+    if (cr !== undefined || cw !== undefined) t.cache = { read: cr, write: cw };
+  }
+  return Object.keys(t).length ? t : undefined;
+}
+
+function parsePart(v: unknown): MessagePart | null {
+  if (!v || typeof v !== "object") return null;
+  const o = v as Record<string, unknown>;
+  const type = typeof o.type === "string" ? o.type : "";
+  if (!type) return null;
+  const part: MessagePart = { type };
+  if (typeof o.text === "string") part.text = o.text;
+  if (typeof o.tool === "string") part.tool = o.tool;
+  if (o.state && typeof o.state === "object") {
+    const s = o.state as Record<string, unknown>;
+    const state: ToolState = {};
+    if (s.input !== undefined) state.input = s.input;
+    if (s.output !== undefined) state.output = s.output;
+    if (typeof s.status === "string") state.status = s.status;
+    if (typeof s.title === "string") state.title = s.title;
+    part.state = state;
+  }
+  return part;
+}

package/src/ratelimit.ts

@@ -0,0 +1,35 @@
+interface Bucket {
+  tokens: number;
+  last: number;
+}
+
+const buckets = new Map<string, Bucket>();
+const IDLE_TTL_MS = 60 * 60 * 1000;
+let lastSweep = 0;
+
+// Token-bucket limiter (H3). Returns true when a token was consumed (allow), false
+// when the bucket is empty (caller answers 429). Guards /login against brute force
+// and /api/* against abuse; idle buckets are swept so memory stays bounded.
+export function rateLimit(id: string, capacity: number, refillPerSec: number): boolean {
+  const now = Date.now();
+  if (now - lastSweep > 5 * 60 * 1000) {
+    lastSweep = now;
+    for (const [k, v] of buckets) if (now - v.last > IDLE_TTL_MS) buckets.delete(k);
+  }
+  let b = buckets.get(id);
+  if (!b) {
+    b = { tokens: capacity, last: now };
+    buckets.set(id, b);
+  }
+  b.tokens = Math.min(capacity, b.tokens + ((now - b.last) / 1000) * refillPerSec);
+  b.last = now;
+  if (b.tokens < 1) return false;
+  b.tokens -= 1;
+  return true;
+}
+
+export function clientIp(req: Request): string {
+  const xff = req.headers.get("x-forwarded-for");
+  if (xff) return (xff.split(",")[0] ?? "").trim();
+  return req.headers.get("x-real-ip") ?? "unknown";
+}

package/src/reactions.ts

@@ -0,0 +1,31 @@
+import { listReactionsFor } from "./store";
+import type { CommentView } from "./render/components";
+
+export const REACTION_EMOJI: Record<string, string> = {
+  "+1": "👍",
+  "-1": "👎",
+  eyes: "👀",
+  heart: "❤️",
+  laugh: "😄",
+  hooray: "🎉",
+  confused: "😕",
+  rocket: "🚀",
+  tada: "🎉",
+};
+
+export function hydrateReactions(views: CommentView[]): void {
+  const ids = views.map((v) => v.id);
+  if (ids.length === 0) return;
+  const aggs = listReactionsFor(ids);
+  const byComment = new Map<number, { e: string; n: number }[]>();
+  for (const a of aggs) {
+    const emoji = REACTION_EMOJI[a.content] ?? a.content;
+    const arr = byComment.get(a.comment_id) ?? [];
+    arr.push({ e: emoji, n: a.n });
+    byComment.set(a.comment_id, arr);
+  }
+  for (const v of views) {
+    const r = byComment.get(v.id);
+    if (r && r.length > 0) v.reactions = r;
+  }
+}

package/src/render/components.ts

@@ -0,0 +1,66 @@
+import { actionBarHTML } from "./layout";
+import type { UserKind } from "../store";
+
+export type ActorTag = "human" | "bot" | "system";
+
+export function classifyActor(body: string, authorKind?: UserKind | null): ActorTag {
+  const b = body ?? "";
+  if (b.startsWith("[system]")) return "system";
+  if (authorKind === "system") return "system";
+  if (authorKind === "bot") return "bot";
+  if (b.startsWith("[bot]")) return "bot";
+  return "human";
+}
+
+export interface CommentView {
+  id: number;
+  tag: ActorTag;
+  login: string;
+  avatar: string;
+  created_at: string;
+  body_html: string;
+  reactions?: { e: string; n: number }[];
+}
+
+const TAG_LABEL: Record<ActorTag, string> = { human: "👤", bot: "🤖", system: "⚙️" };
+
+function esc(s: string): string {
+  return (s ?? "")
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;");
+}
+
+export function relTime(iso: string): string {
+  const t = Date.parse(iso);
+  if (!Number.isFinite(t)) return "";
+  const d = (Date.now() - t) / 1000;
+  if (d < 60) return "刚刚";
+  if (d < 3600) return Math.floor(d / 60) + "分钟前";
+  if (d < 86400) return Math.floor(d / 3600) + "小时前";
+  if (d < 86400 * 30) return Math.floor(d / 86400) + "天前";
+  return new Date(t).toISOString().slice(0, 10);
+}
+
+// Must match app.js cardHTML so client hydration/polling produce identical markup.
+export function renderCommentCard(c: CommentView): string {
+  const tag = c.tag || "human";
+  const label = TAG_LABEL[tag] || "👤";
+  const rx =
+    c.reactions && c.reactions.length
+      ? `<span class="rx">${c.reactions
+          .map((r) => `<span class="rxc">${r.e}<span class="rxn">${r.n}</span></span>`)
+          .join("")}</span>`
+      : "";
+  return (
+    `<div class="item item-${esc(tag)}" id="comment-${c.id}" data-id="${c.id}">` +
+    `<div class="card"><div class="card-h">` +
+    `<span class="tag tag-${esc(tag)}">${label} ${esc(tag)}</span>` +
+    `<span class="who">${esc(c.login)}</span>` +
+    `<span class="when" data-ts="${esc(c.created_at)}" title="${esc(c.created_at)}">${relTime(c.created_at)}</span>` +
+    rx +
+    `<span class="card-actions">` + actionBarHTML({ cid: String(c.id), copy: true, link: true, translate: true, tts: true }) + `</span>` +
+    `</div><div class="card-b">${c.body_html}</div></div></div>`
+  );
+}